Question

You configured an HA VPN tunnel between Google Cloud and an on-premises router. The tunnel status shows 'Established', but the BGP session on the Cloud Router remains in a state where routes are not being exchanged. You verify that the Cloud Router uses Google ASN 65001 and advertises subnet routes correctly. On the on-premises side, the peer is configured with ASN 65001 as its local ASN, and the BGP peer IP addresses fall within the same /30 link-local range you assigned in the BGP session configuration. What is the most likely cause of the BGP session failure?

Accepted Answer

The on-premises router and Cloud Router are both configured with ASN 65001, causing an unintended iBGP relationship instead of the expected eBGP peering.

Answer

HA VPN requires the Cloud Router to use a 4-byte ASN, so 65001 is invalid and must be replaced with a value above 65535.

Answer

The BGP peer IP addresses must be from a public IP range, not link-local (169.254.0.0/16), for the session to establish.

Answer

BGP route exchange only begins after Cloud Router is set to a custom advertisement mode; the default base mode blocks all route exchange.